[Interface]
PrivateKey = {{ wireguard_server_private_key }}
Address = {{ wireguard_ingress_address }}
ListenPort = {{ wireguard_ingress_port }}
PostUp   = sysctl -w net.ipv4.ip_forward=1

{% for port in wireguard_dnat_ports %}
PreUp = iptables -t nat -A PREROUTING -i eth0 -p tcp --dport {{ port }} -j DNAT --to-destination {{ wireguard_beepi_ip }}:{{ port }}
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp --dport {{ port }} -j DNAT --to-destination {{ wireguard_beepi_ip }}:{{ port }}
{% endfor %}

#PreUp = iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
#PostDown = iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE

# ----- site-to-site: beepi -----
[Peer]
PublicKey = {{ wireguard_beepi_public_key }}
AllowedIPs = {{ wireguard_beepi_ip }}/32

{% for peer in client_public_keys.results %}
# ----- road-warrior: {{ peer.item.name }} -----
[Peer]
PublicKey = {{ peer.stdout }}
PresharedKey = {{ lookup('file', wireguard_client_dir ~ '/' ~ peer.item.name ~ '.psk.private') }}
AllowedIPs = {{ peer.item.ip }}/32
{% endfor %}